Python zlib Module - Remote 缓冲区溢出

admin

0
文章

0
评论

2023-12-12 01:20:05 Ali_nvd 来源：ZONE.CI 全球网 0 阅读模式

中危 Python zlib Module - Remote 缓冲区溢出

CVE编号

CVE-2008-1721

利用情况

POC 已公开

补丁情况

没有补丁

披露时间

2008-04-11

漏洞描述

Python 2.5.2及更早版本中 zlib extension module 中的整数签名错误允许远程攻击者通过负签名整数执行任意代码，这会触发内存分配不足和缓冲区溢出。

解决建议

建议您更新当前系统或软件至最新版，完成漏洞的修复。

参考链接
http://bugs.python.org/issue2586
http://lists.apple.com/archives/security-announce/2009/Feb/msg00000.html
http://secunia.com/advisories/29889
http://secunia.com/advisories/29955
http://secunia.com/advisories/30872
http://secunia.com/advisories/31255
http://secunia.com/advisories/31358
http://secunia.com/advisories/31365
http://secunia.com/advisories/33937
http://secunia.com/advisories/37471
http://secunia.com/advisories/38675
http://security.gentoo.org/glsa/glsa-200807-01.xml
http://securityreason.com/securityalert/3802
http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackw...
http://support.apple.com/kb/HT3438
http://support.avaya.com/css/P8/documents/100074697
http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0149
http://www.debian.org/security/2008/dsa-1551
http://www.debian.org/security/2008/dsa-1620
http://www.mandriva.com/security/advisories?name=MDVSA-2008:085
http://www.securityfocus.com/archive/1/490690/100/0/threaded
http://www.securityfocus.com/archive/1/507985/100/0/threaded
http://www.securityfocus.com/bid/28715
http://www.securitytracker.com/id?1019823
http://www.ubuntu.com/usn/usn-632-1
http://www.vmware.com/security/advisories/VMSA-2009-0016.html
http://www.vupen.com/english/advisories/2008/1229/references
http://www.vupen.com/english/advisories/2009/3316
https://exchange.xforce.ibmcloud.com/vulnerabilities/41748
https://issues.rpath.com/browse/RPL-2444
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.ova...
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.ova...
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.ova...

受影响软件情况

1
#	类型	厂商	产品	版本	影响面
	运行在以下环境
	应用	python_software_foundation	python	*		Up to (including) 2.5.2
	运行在以下环境
	系统	centos_5	python	*		Up to (excluding) 2.4.3-24.el5_3.6
	运行在以下环境
	系统	oracle_5	oraclelinux-release	*		Up to (excluding) 2.4.3-24.el5_3.6
	运行在以下环境
	系统	redhat_5	python	*		Up to (excluding) 0:2.4.3-24.el5_3.6
	运行在以下环境
	系统	redhat_6	nss	*		Up to (excluding) 0:3.12.10-6.el4
	运行在以下环境
	系统	suse_11	python	*		Up to (excluding) 2.6.0-8.9